Google Dismantles X.CPE Botnet and Bans Videostrong Technology

Google led a coordinated effort with security firms and Japan's National Police Agency to dismantle X.CPE, a global botnet that compromised more than 1.3 million Android TV set-top boxes and other IoT devices across 200 countries. The malware also affected karaoke machines, telehealth devices, and digital signage hardware.

Google's Threat Intelligence Group determined that China-based Videostrong Technology Co. intentionally embedded the malware into device firmware before sale. Videostrong allegedly operated the backdoor for financial gain, selling access to criminal affiliates who used the residential connections for ad fraud, data exfiltration, and bandwidth reselling. The company used obfuscation techniques to bypass compatibility tests and load malicious code after the first boot.

To disrupt the operation, Google took legal action to shut down command-and-control domains and servers. This action is estimated to sever access to an additional 10 million compromised devices. In response to the supply chain breach, Google banned Videostrong and its affiliates from producing certified Android devices or using preloaded Google apps. Google has since updated its security review and device certification processes to prevent similar incidents.